hi,beacon use bokuloader fails to run on cs 4.9 version

[kk-secboy]

I've found that bokuloader runs well on version cs4.7, but it fails to run on version 4.9. The rdll size has been set to 100k. Could it be due to the changes in the beacon in version 4.9?

[boku7]

Idk I haven’t tried it since the last release we did for call stack spoofing. I don’t use CS anymore. I know they’ve been making allot of changes so maybe there’s some bug now with the integration reverse compatibility? If you figure it out lmk, I’d be interested

[kk-secboy]

I guess it's because there have been some big changes in the beacon of the high-version CS. Idk, busy recently . So I choose to continue using the old version of CS. LMAO.

[michialdd]

it seems not the problem of cs 4.9 , because bokuloader runs well on my version cs4.9.1. It seems the problem of windows 11 pro (10.0.26100 N/A Build 26100 or later), windows 11 pro seems change the ntdll file (but i don't know where it is changed which makes the bokuloader doesn't run well)

[alexlee820]

it seems not the problem of cs 4.9 , because bokuloader runs well on my version cs4.9.1. It seems the problem of windows 11 pro (10.0.26100 N/A Build 26100 or later), windows 11 pro seems change the ntdll file (but i don't know where it is changed which makes the bokuloader doesn't run well)

I don't think the problem is caused by ntdll. It seems that the PEB walk triggers an array index overflow when a module has not been loaded. If you want to know more details, can take a look at the new pull request. Also, it works fine for me on Windows 11 after making a if statement.